Prevent forging of messages via carbons.

e81eaf32 · JC Brand · 0cf99037 · e81eaf32 · e81eaf32 · e81eaf32
Commit e81eaf32 authored Jan 31, 2017 by JC Brand
Hide whitespace changes
Inline Side-by-side

Showing with 53 additions and 2 deletions

docs/CHANGES.md docs/CHANGES.md +1 -0

spec/chatbox.js spec/chatbox.js +44 -1

src/converse-core.js src/converse-core.js +8 -1

No files found.
--- a/docs/CHANGES.md
+++ b/docs/CHANGES.md
@@ -10,6 +10,7 @@
 - Bugfix. Login form wasn't rendered after logging out (when `auto_reconnect` is `true`). [jcbrand]
 - Bugfix. Properly disconnect upon "host-unknown" error. [jcbrand]
 - Bugfix. Minimized chats weren't removed when logging out. [jcbrand]
+- Security fix: Prevent message forging via carbons. (Thanks to ge0rg) [jcbrand]
 ## 2.0.4 (2016-12-13)
 - #737: Bugfix. Translations weren't being applied. [jcbrand]

--- a/spec/chatbox.js
+++ b/spec/chatbox.js
@@ -766,7 +766,7 @@
                    var msgtext = 'This is a carbon message';
                    var sender_jid = mock.cur_names[1].replace(/ /g,'.').toLowerCase() + '@localhost';
                    var msg = $msg({
-                            'from': converse.bare_jid,
+                            'from': sender_jid,
                            'id': (new Date()).getTime(),
                            'to': converse.connection.jid,
                            'type': 'chat',
@@ -844,6 +844,49 @@
                    expect(msg_txt).toEqual(msgtext);
                }));
+                it("will be discarded if it's a malicious message meant to look like a carbon copy", mock.initConverse(function (converse) {
+                    test_utils.createContacts(converse, 'current');
+                    test_utils.openControlBox();
+                    test_utils.openContactsPanel(converse);
+                    /* <message from="mallory@evil.example" to="b@xmpp.example">
+                     *    <received xmlns='urn:xmpp:carbons:2'>
+                     *      <forwarded xmlns='urn:xmpp:forward:0'>
+                     *          <message from="alice@xmpp.example" to="bob@xmpp.example/client1">
+                     *              <body>Please come to Creepy Valley tonight, alone!</body>
+                     *          </message>
+                     *      </forwarded>
+                     *    </received>
+                     * </message>
+                     */
+                    spyOn(converse, 'log');
+                    var msgtext = 'Please come to Creepy Valley tonight, alone!';
+                    var sender_jid = mock.cur_names[1].replace(/ /g,'.').toLowerCase() + '@localhost';
+                    var impersonated_jid = mock.cur_names[2].replace(/ /g,'.').toLowerCase() + '@localhost';
+                    var msg = $msg({
+                            'from': sender_jid,
+                            'id': (new Date()).getTime(),
+                            'to': converse.connection.jid,
+                            'type': 'chat',
+                            'xmlns': 'jabber:client'
+                        }).c('received', {'xmlns': 'urn:xmpp:carbons:2'})
+                          .c('forwarded', {'xmlns': 'urn:xmpp:forward:0'})
+                          .c('message', {
+                                'xmlns': 'jabber:client',
+                                'from': impersonated_jid,
+                                'to': converse.connection.jid,
+                                'type': 'chat'
+                        }).c('body').t(msgtext).tree();
+                    converse.chatboxes.onMessage(msg);
+                    // Check that chatbox for impersonated user is not created.
+                    var chatbox = converse.chatboxes.get(impersonated_jid);
+                    expect(chatbox).not.toBeDefined();
+                    // Check that the chatbox for the malicous user is not created
+                    chatbox = converse.chatboxes.get(sender_jid);
+                    expect(chatbox).not.toBeDefined();
+                }));
                it("received for a minimized chat box will increment a counter on its header", mock.initConverse(function (converse) {
                    test_utils.createContacts(converse, 'current');
                    test_utils.openControlBox();

--- a/src/converse-core.js
+++ b/src/converse-core.js
@@ -1447,7 +1447,14 @@
                }
                $forwarded = $message.find('forwarded');
                if ($forwarded.length) {
-                    $message = $forwarded.children('message');
+                    var $forwarded_message = $forwarded.children('message');
+                    if (Strophe.getBareJidFromJid($forwarded_message.attr('from')) !== from_jid) {
+                        // Prevent message forging via carbons
+                        //
+                        // https://xmpp.org/extensions/xep-0280.html#security
+                        return true;
+                    }
+                    $message = $forwarded_message;
                    $delay = $forwarded.children('delay');
                    from_jid = $message.attr('from');
                    to_jid = $message.attr('to');